[Full-Disclosure] Virus / Trojan

From: Otero, Hernan (EDS) (HOtero_at_lanchile.cl)
Date: 01/09/04

  • Next message: John LaCour: "RE: [Full-Disclosure] Virus / Trojan" 
    To: full-disclosure@lists.netsys.com
Date: Fri, 9 Jan 2004 15:47:43 -0400

    Today found this suspicious file attached to an email, obviously is a virus
    (our AV donīt detect it :-( ). The virus/trojan is very simple, the
    developer only put effort in obfuscate the strings inside the binary.

    The executable file try to connect to gamemaniacs.org and download a file.
    This file will be located in the system directory

    The url used in the GET is:

    gamemaniacs.org /download/get.php?dist=2
     
    This will download the binary saved as msvchost.exe

    any one know what virus/trojan is this?

    -H

     <<VIRUS1_DETECTED_AND_REMOVED_winxp_sp1_VIRINFO.TXT>>

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: John LaCour: "RE: [Full-Disclosure] Virus / Trojan"

    Relevant Pages

    • Re: [Full-Disclosure] Virus / Trojan
      ... > Today found this suspicious file attached to an email, obviously is a virus ... > developer only put effort in obfuscate the strings inside the binary. ... > The executable file try to connect to gamemaniacs.org and download a file. ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] Virus / Trojan
      ... your AV scanner on your Exchange server detected it (or extension ... Subject: Virus / Trojan ... The virus/trojan is very simple, ... The executable file try to connect to gamemaniacs.org and download a file. ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] Virus / Trojan
      ... Subject: [Full-Disclosure] Virus / Trojan ... The virus/trojan is very simple, ... The executable file try to connect to gamemaniacs.org and download a file. ...
      (Full-Disclosure)
    • Re: Please be careful renaming threads!
      ... I've been getting a ton of those lately. ... download a virus/trojan that turns your machine into one of their ... but can a virus hide in one? ...
      (rec.food.cooking)
    • RE: [Full-Disclosure] Virus / Trojan
      ... the developer only put effort in ... > obfuscate the strings inside the binary. ... > This will download the binary saved as msvchost.exe ... > any one know what virus/trojan is this? ...
      (Full-Disclosure)